AO 106 (Rev. 04/10) Application fora Search Warrant 


United States District Court 

for the 

District of Alaska 


In the Matter of the Search of ^ 

(Briefly describe the property to be searched ) 

or identify the person by name and address) ) Case No. 3:18-mj-00382 

Apple iPhone, IMEI 359305064431893 ) 

And Seagate Hard Drive S/N W765SX82, both currently | 
located at the McLaughlin Youth Center, Anchorage, AK 

APPLICATION FOR A SEARCH WARRANT 

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under 
penalty of perjury that 1 have reason to believe that on the following person or property (identify the person or describe the 
property to be searched and give its location): 

See Attachment A, incorporated here by reference. 

located in the _ District of_ A laska _ _, there is now concealed (identify the 

person or describe the property to be seized)'. 

See Attachment B, incorporated here by reference. 

The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): 
l?f evidence of a crime; 

□ contraband, fruits of crime, or other items illegally possessed; 

□ property designed for use, intended for use, or used in committing a crime; 

□ a person to be arrested or a person who is unlawfully restrained. 

The search is related to a violation of: 

18 U.S.C. §§ 2422 Attempted coercion and enticement of a minor 


The application is based on these facts: 

See attached Affidavit in Support of Search Warrant. 

fif Continued on the attached sheet. 

□ Delayed notice of_days (give exact ending date if more than 30 days:_) is requested 

under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet. 


Sworn to before me and signed in my presence. 
Date: / V cP 




City and state: Anchorage, Alaska 


Signature Redacted 

Tl- .. gnature 

_ Special Agent Daryl Allison, FBI 

Printed name and title 


ISI BERNARD ZIMMERMAN . 

^ U.S. MAGISTRATE JUDGE , 

L, SIGNAT URE REDACTED 

'Judge's signature • ZZ -- 




tied States Magistrate Judge 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


IN THE MATTER OF THE SEARCH OF 

Apple iPhone, IMEI 359305064431893 
And Seagate Hard Drive S/N W765SX82, 
both currently located at the McLaughlin 
Youth Center, Anchorage, Alaska 


) Case No. 3:18-mj-00382 


) 

) UNDER SEAL 

) 

) 

) 

) 


AFFIDAVIT IN SUPPORT OF AN APPLICATION 
UNDER RULE 41 FOR A WARRANT TO SEARCH AND SEIZE 


I, Daryl Allison, being first duly sworn, hereby depose and state as follows: 
INTRODUCTION AND AGENT BACKGROUND 

1. I make this affidavit in support of an application under Rule 41 of the 
Federal Rules of Criminal Procedure for a warrant to search the person of Dennis 
Henry Weston, the premises known as 13431 Baywind Drive, Alaska (hereinafter 
“SUBJECT PREMISES”), and any person located at the SUBJECT PREMISES, 
both further described in Attachment A, for the things described in Attachment B. 

2. I am a Special Agent (SA) with the Federal Bureau of Investigation 
(FBI), and have been since October 2003. In this assignment I have investigated a 
number of violations of United States Code. For the past several years, I have 
investigated crimes against children including but not limited to internet crimes 
against children, online enticement of children, child pornography possession and 
distribution. I have conducted and participated in search warrants, arrest 
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warrants, and interviews of people involved in crimes against children. I have 
also attended trainings specific to the use of computers in the commission of 
crimes against children. 

3. I have attended the following computer based training with an 
emphasis in online investigations involving the sex trafficking of minors: 

Innocent Images Online Basic Training Program; Violent Crimes Against 
Children Forensic Interviewing. 

4. This affidavit is made in support of an application for a warrant to 
search the person of Dennis Henry Weston and the entire SUBJECT PREMISES, 
which are more particularly described in Attachment A, inclusive of the mobile 
devices, and to seize the items specified in Attachment B, which constitute 
instrumentalities, fruits, contraband, and evidence of violations, or attempted 
violations, of 18 U.S.C. §§ 2422, attempted coercion and enticement of a minor. 

5. I am familiar with the information contained in this affidavit based 
upon the investigation I have conducted, which included conversations with law 
enforcement officers and others and review of reports and database records. 

6. Because I submit this affidavit for the limited purpose of securing a search 
warrant, I have not included each and every fact known to me or the government. 
I have only included those facts necessary to establish probable cause to believe 
that evidence of violations, or attempted violations, of 18 U.S.C. §§ 2422 are 
located on the person of Dennis Henry Weston and/or at the 

SUBJECT PREMISES. 
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7. This affidavit is made in support of an application for a warrant to search the 
person Dennis Henry Weston (date of birth May 19, 1964) and his residence located 
at 13431 Baywind Drive, Anchorage, Alaska, which are more particularly described 
in Attachment A, and to seize the items specified in Attachment B, which constitute 
instrumentalities, fruits, contraband, and evidence of violations, or attempted 
violations, of 18 U.S.C. § 2242(b), attempted coercion and enticement of a minor. 

8. I am familiar with the information contained in this affidavit based upon the 
investigation I have conducted, which included conversations with law enforcement 
officers and others and review of reports and database records. 

9. Because I submit this affidavit for the limited purpose of securing a search 
warrant, I have not included each and every fact known to me or the government. I 
have only included those facts necessary to establish probable cause to believe that 
evidence of violations, or attempted violations, of 18 U.S.C. §§ 2242(b) are located on 
the person of Dennis Henry Weston and/or in the SUBJECT PREMISES. 

BACKGROUND OF THE INVESTIGATION 

10. On April 24, 2017 and undercover FBI employee (UCE) posted an ad in the 
personals section of the Craigslist.com web site. The title of the ad was “Daughter 
just arrived in town — w4m (Wasilla).” The body of the ad read as follows: 

Just awarded custody of my lOyo daughter from down south. She is quite a 
handful and needs to gets some energy out. If you think you can handle her 
she needs a babysitter. We can work out the terms later. 
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11. The UCE received numerous responses to the ad by email that same day. 

The UCE replied to all of the emails and sent the phone number of an undercover 
cell phone to a number of the email addresses, the users of which expressed an 
interest in continuing to converse about the UCE’s ten year old daughter. 

12. That same day an individual using the phone number 907-723-1334, 
hereinafter “the SUBJECT,” sent a text message to the UCE. The UCE was not 
able to determine which email address the individual had been using to initiate 
communication with the UCE. 

13. During the initial conversation the SUBJECT discussed with the UCE the 
UCE’s “childcare” situation. During this conversation the SUBJECT asked the 
UCE “Would we be watching her together or on my own?” to which the UCE replied 
“Together.” The UCE asked the SUBJECT if he/she had done any babysitting 
before, to which SUBJECT replied “Yes.” SUBJECT asked how old the UCE’s 
daughter was, to which the UCE replied “lOyo.” SUBJECT then asked “And your 
interested in helping with her supervision?” to which the UCE replied “Yes 
definitely.” 

14. The UCE continued an intermittent conversation over text message with the 
SUBJECT through June of 2018. 

15. On April 26, 2017 the SUBJECT asked the UCE “Won’t bother you with 
endless texts if someone has been found to help you out with Becky but if your still 
looking I am open to the next step.” The text message was signed “John.” 
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16. The UCE responded on April 26, 2017 and told the SUBJECT that he was 
still looking and asked the SUBJECT “You done this before?” The SUBJECT 
responded “Understand and yes watched over young girls before.” The UCE 
told the SUBJECT “...we have played a little but I’m not sure the best way to go 
about some things.” The SUBJECT responded “What play activities are you unsure 
about? Bedtime, bath time, games????” The following conversation then occurred. 
The SUBJECT’S questions/responses are on the left in grey and the UCE’s are on 
the right in blue. 


Just don't ant to hurt her 


Course not, what's the confusing 
part? 


Not sure we are on the same page 


I know the page I am on... 


Me too. I guess I just need to say it. 


Ok no judgement here 
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We haven't been able to do full pen 
yet 


She likes to play? 


Seems to. Just not as far as that yet. 
Uncomfortable for her 


Ok so why the CL add? 


Think I might like to watch 


Ok 

Your call on that... 


Definitely want to be there 


Absolutely 

Based on my training and experience “full pen” is often used to refer to full 
penetration sexual activity. The UCE then asked the SUBJECT “Have you done 
this before?” to which the SUBJECT replied “Not unfamiliar territory.” Shortly 
thereafter the SUBJECT stated “...Gotta go for now....bye.” 

17. On April 27, 2017 the UCE reinitiated contact with the SUBJECT and asked 
“You still interested in meeting?” The SUBJECT responded “No interest in the 
least.” 

18. On April 28, 2017 the SUBJECT reinitiated contact and stated 
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Fri, Apr 28, 5:42 AM 


Sorry about that, significant other 
found my phone charging and 
"assumed" some woman was trying 
to meet up. 

Gotta let be the jealousy. 

Get back when you can 


19. On April 28, 2017 the UCE reinitiated contact with the SUBJECT. During 
the conversation the SUBJECT asked: 


You know of any good adult websites 
that actor to our interests? 


20. On May 3, 2017 the UCE reinitiated contact and asked the SUBJECT if he 
wanted to meet that week. The SUBJECT and UCE briefly discussed logistics of 
meeting, after which the SUBJECT asked: 
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Do you do her laundry? 


Usually. Trying to teach her to do her 
own. 


You will know she is ready to play by 
checking out her panty liners 

When doing her laundry 


• . 


What do you mean? She seem to like 
it now. 


She needs to be wet to enjoy playing 
and that wetness will stain her 
panties when she is ready 


The conversation was terminated shortly thereafter. 

21. On May 7, 2017 the SUBJECT initiated contact with the UCE and the 
following conversation ensued: 
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Sunday 3:30 PM 


Hey 


Sunday 6:30 PM 


Hey. Been away from the phone 
today. 

BjBBBr^BacTfro^^ome? 


Sunday 8 05 PM 

Actually no and it appears that I will 
be based out on the bush for the 
summer. 

Going to take a break from the 
"fantasy babysitter" and wanted to let 
you know in advance as most places 
in bush AK don't have AT&T, just GCI. 
Give ya one guess which carrier I use. 

Cheers 

John 


22. On May 14, 2017 the SUBJECT reinitiated contact with the UCE: 


Sun, May 14, 7:02 AM 

Back in town for a few days and plan 
to be in the valley next week. 


The UCE did not see the message and did not respond until the following week. 
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23. On May 20, 2017 the UCE responded to the SUBJECT’S previous message. 
The UCE and the SUBJECT briefly discussed meeting the following week. 

24. On May 24, 2017 the SUBJECT reinitiated contact and asked the UCE to 
describe his daughter’s body. The UCE and SUBJECT briefly discussed meeting 
and the SUBJECT bringing a gift for the UCE’s daughter. The UCE suggested an 
age appropriate toy. The SUBJECT replied: 


Although they don't always know it, 
vibrating massagers and pulsating 
shower nozzles are great gifts 




I guess you would have to show her 
how to use them 


Is she matured enough for that? 




You suggested it, I thought maybe 
you knew. 


..:. :••• • ■! 7 :,: - 


Would need to see her nips and slit to 
know 


25. The following discussion then took place: 
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Is this "fantasy" for you of do you 
want to play? 


Inside ring it started with a CL add 
and the subsequent subject matter 
was very risky I was always thinking 
fantasy. 

Guessing now you are looking to play 


Was always looking to play. Thought 
you were too. 


Understand 

Think about the possibilities daily 



Did you plan for me to simply come 
to your home and meet Becky? 

Just asking as that's not how it 
works. 
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No. Don't really know you except 
through text so would maybe meet at 
hotel or something. 


Secrecy and maintaining privacy is 
the key given the risks 


This is first time I have tried to meet 
someone so I don't know how it 
works. 


In reality none can be able to identify 
the others. 


That's why I suggested a hotel 


Can Becky be trusted? 


I think so, I have told her that she 
would have to go back to her mother 
if anyone found out. Her mother 
uses. 


In this social media day and age it's 
practically impossible to keep 
anything private. 

School and doctors offices are asking 
probing question as well. 


26. The conversation between the UCE and the SUBJECT continued 
intermittently until August 16, 2017 at which time the SUBJECT asked. 
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Down in Arizona this week, back next 
week. 

Are you in Anch next week? 


The UCE responded on August 18, 2017: 


I will be around next week. What do 
you have in mind? 


Hoping to meet up and make plans 

I will LAN to be in Palmer next week 
also if that works better for you 

Any stained panties yet? 


Yes. Really started looking after you 
pointed that out. 
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How is beckys chest developing? 

What's her favorite activity when you 
guys play doctor???? 


Starting to see some development in 
her chest 


Her nipples should be getting 
sensitive. Does she like having them 
touched? 




They are a little sensitive but she is 
ok with them being touched after we 
get warmed up a little 


Her pubic hair will start to grow in her 
slit first and that's when she will start 
to stain her panty liner heavy 
everyday. 

That's a great time to play and 
explore. She will be curious and 
excited because everything feels 
good 


The SUBJECT then asked for a picture of the UCE’s daughter. The 

SUBJECT then continued: 
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And her little cunt hair will get more 
course and dark in the mouths ahead 

Fully dressed is fine 


Do you prefer hair or not 


I prefer slit hair at the early stage 
because the clit and cunt hole are 
usually drenched with creamy 
discharge in preparation for sex play 
and the monthly period that starts a 
bit later 


Based on the SUBJECT’S request for a photo, the UCE sent an age 
regressed photo of another FBI agent by text message. The conversation 
then continued: 

Very nice 
She looks great 

. 


Do you want to see for yourself ? 


Yes 
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Looking at her picture I am thinking 
her panties would be heavily stained 
every morning with creamy juice 

She needs a sitter when your busy, 
right? 


27. The UCE and SUBJECT continued to discuss meeting. The UCE asked the 
SUBJECT: 


Are you really up for it. Seems like 
we have been talking about it for a 
while but hasn't happened. Don't 
want to get too excited about it if you 
really aren't into it 


Into it ? Yes. That said it's risky 
behavior for everyone and that can 
be a damper on the excitement 


Yes I understand. If you don't want to 
that's cool just let me know so I can 
look for someone else. 
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Back now, 


Meeting Becky would be fun if done 
right and made her feel comfortable. 

Meeting a complete stranger in a 
hotel room would be frightening for 
any girl and not end well for anyone. 


The subject then proposed a plan to meet the UCE and his daughter at a 
public pool where the SUBJECT could initiate sexual contact with the 
UCE’s daughter while playing with her in the pool. Later in the discussion 
the SUBJECT asked: 


Sure you have seen some porn where 
young girls have been sexually 
educated through the use of 
gloryhole or play doctor sessions. 

Sound like something Becky would 
like at some point? 

First time getting titties licked, cunt 
fingered, first taste of cum, first cock. 

It's all on the menu when the time is 
right? 


28. On September 5, 2017 an FBI UCE conducted a recorded phone call with an 
individual using the SUBJECT phone number. The SUBJECT asked how the 
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UCE’s daughter was doing. The UCE and the subject discussed meeting at a 
public pool. The SUBJECT then asked “What is her interest? I mean if she has 
no interest it’s all for nothing. No interest in, you know, playing or being naked.” 
The UCE told the SUBJECT that he had been sexually active with his daughter. 
The SUBJECT asked “How far have you been able to take this with her?” The 
UCE described sexual activity with his daughter. The SUBJECT then asked if the 
UCE was concerned that his daughter might tell someone about their activity. 

The UCE stated that he was not concerned. Later in the conversation the 
SUBJECT asked “Is she able to get wet yet?” He then stated “When she starts 
staining her panties...her cunt is getting ready to, you know, be active.” Later in 
the conversation the UCE asked the SUBJECT what he wanted to do with the 
UCE’s daughter. The SUBJECT replied “There’s usually, you know, licking and 
sucking, exploration before anybody is, uh, screwing anybody else.” The 
SUBJECT stated to the UCE “I’ve got another person who is dying to meet her 
too, but I haven’t said anything about her to him. But usually this is down the 
road a ways.” The UCE expressed his desire to move slowly. The SUBJECT 
replied “This takes months.” “And I’ll tell you what, kind of, his fantasy is, and 
see where this fits in your long term plans. His fantasy is basically for, uh, for 
him, his fantasy is to kind of rub his cock up and down her slit until he erupts all 
over it...he wants to completely cover her slit with his juice and then um hopefully 
she can either feel good and orgasm too and have me down there either cleaning it 
up or helping out.” The UCE then asked the SUBJECT if he was serious about 


Case 3:18-mj-00382-DMS Document 1-1 Filed 07/19/18 Page 18 of 40 


meeting. The SUBJECT and UCE then discussed the possible repercussions of 
the activities discussed. 

29. Approximately two hours after the call terminated, the SUBJECT sent the 
following text message: 


Tue, Sep 5, 7:50 PM 

Interesting chat, anyway you did ask 
when this fantasy would turn reality 
and the answer for me is never. 

After a few minutes thinking about 
things it seems the News is full of 
scandals and heartbreak when these 
things go bad, and they always go 
bad one way or the other, so I want 
no part of it, now or ever. 

Consider this my final word on the 
matter and let's part ways on that 
note so you can look elsewhere for 
your fun 


The UCE then sent a message to the SUBJECT asking if the subject’s 
girlfriend had found his phone again. 

30. The UCE sent the following message on October 23, 2017. 

Mon, Oct 23, 12:20 PM 


Still around if you changed your mind 
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31. After receiving no other contemporaneous messages from the SUBJECT, the 
UCE stopped checking the undercover phone for messages. The phone was left on 
and the battery was completely drained. 

32. On November 21, 2017, the phone was charged and checked by the UCE, who 
found the following messages on the phone. 

Mon, Oct 30, 7:44 PM 

Jason, 

Been in trip up north. Got your 
message and realized I had sent a 
couple text to wrong number. 

How is Becky? 


Tue, Oct 31,10:4 / AM 

Let me know a good time to call you 


Mon, Nov 20, 3:56 PM 

Hey, this still Jason's contact 
number? If not sorry and disregard 

John 
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Tuc, Nov 21,1:17 PM 


No response so probably got the 
number right but lost the connection 
with Jason and Becky. 

Hope to hear back at some point 
down the road. 

John 


33. The UCE expressed to the SUBJECT that the UCE did not expect to hear 
from the SUBJECT again. The SUBJECT told the UCE he would explain his 
absence at a later date. The SUBJECT then continued: 


I will say that your description of 
Becky is very exciting and has me 
very turned on. 

That said my "weakness " is when 
things are starting to get hard and 
sensitive up top and those fine hairs 
start growing in leading to nicely 
stained panty liners 


The UCE asked if the SUBJECT still wanted to get together and expressed his 
disappointment at the SUBJECT’S lack of communication. The SUBJECT replied: 
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Understood. 


Did mention the scenarios we 
discussed on the phone with a guy I 
know here in Anchorage. He was very 
interested but we are all concerned 
about Becky being comfortable 


34. On November 21, 2017 UCE contacted the SUBJECT by text message. The 
SUBJECT expressed that he had been thinking about the UCE’s daughter a lot 
and asked about her physical development. He then abruptly stated: 


But to answer your original question, 
no, I am not the guy who will be 
meeting up with anyone for anything 
like this. 

Subject matter is intriguing, and I 
think about it constantly, but in this 
day age it's a mine field and that's a 
step I won't take. 


35. The UCE had no contact with the SUBJECT until February 8, 2018. The 
UCE then sent the following message to the SUBJECT: 

Thu, Feb 8, 10:09 AM 


I expected to hear from you already 


The SUBJECT replied: 
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Becky has been on my mind 
How is she doing? 


The SUBJECT then requested to speak to the UCE on the phone. Shortly 
thereafter, a UCE placed a phone call to the SUBJECT. The UCE and SUBJECT 
discussed meeting to sexually molest the UCE’s daughter. The SUBJECT 
expressed reservations due to the possibility of getting caught by law enforcement. 
Subsequent to the phone call, the following text message conversation occurred: 


Sounds like your very turned on. I am 
also 

How does the crotch of her panties 
look on the morning? 

The liner should be getting very wet 
about now....let's us know her body is 
ready for action 

And how is her chest coming along? 


am really hard now thinking about it 



She has stains in her panties 


Any hair starting to grow in the slit? 
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Very fine hair. Have to look close but 
it's there 


Very nice, makes you a great "good 
night" kiss 




Yeah. I don't mind getting in close 




I think about giving her a warm full 
body shower then close chest and 
slit inspection 

I know you would enjoy watching and 
she would like the feeling 


What are the requirements to pass 
your "inspection"? 


Sensitivity to the touch, her clit 
getting hard, her cunt hole twitching 
when fingered, and her nipples 
starting to swell and go erect. 

While you watch of course 


I think she will pass ® 
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You did mention she like to suck 
cock, right? 




Yes she does. She likes to please 


What does she think of the taste and 
texture of cum? Little sluts have to 
learn to enjoy cum 




Do you think your cock will fit in her 
mouth? 




She will take the cum 


Need picture to be sure on the size 
I am 7 inches and average thickness 


I am sure she can take that 


Only fair, I will swallow her orgasm 
cum in return 
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You will love the taste 

L. ^ 


Do her nipples swell up and get erect 
yet when you lick them? 


Yes. They are still small but get real 
hard 


Rock hard here!!! 

Then her panties will be more than 
stained soon, they will be DRENCHED 
in her wetness 


f 'jZ . \ ' • ' r'-.V 


Same here. Might have to go pick 
her up from school early 


Very hot 

When I meet her, think a vibrator 
might be a good tt 




She would appreciate a new toy 


And I would love to see you use it on 
her 


Case 3:18-mj-00382-DMS Document 1-1 Filed 07/19/18 Page 26 of 40 


Does she take her toy deep in her 
little cunt? 


Or just rub her clit 


She likes both 


Very nice 

IDENTIFICATION OF THE SUBJECT PHONE 

36. On April 27, 2017 an administrative subpoena was issued to AT&T for 
subscriber information for the phone number 907-723-1334. On April 28, 2017 
and email was received from AT&T indicating that the subscriber for the number 
was Dennis H Weston, 13431 Baywind Drive, Anchorage, Alaska. The service 
originated on February 6, 2012. 

37. On February 28, 2018 another administrative subpoena was issued to AT&T 
for the subscriber information for the same number, 907-723-1334. The 
information returned again indicated that the subscriber was Dennis H Weston, 
13431 Baywind Drive, Anchorage, Alaska with a service origination date of 
February 6, 2012. 

38. A search of the Alaska Department of Labor indicated that Weston was 
employed by the State of Alaska Department of Administration. A check of the 
Alaska Department of Motor Vehicles database revealed that Weston listed his 
title with the state of Alaska as Division Operations Manager. According to the 
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Alaska Department of Health and Social Services Office of the Commissioner, 
Weston was listed as the Deputy Director of Operations of the Alaska Juvenile 
Justice System. 

39. On February 5, 2018, Weston appeared by chance for jury duty in federal 
district court, District of Alaska. During questioning Weston revealed that he was 
the Deputy Director of Operations for the Alaska Juvenile Justice System and had 
been the Superintendent of the Anchorage, Kenai, MatSu Valley and Juneau 
juvenile detention facilities during the course of his career with the State of 
Alaska. He has also volunteered his time with Covenant House, a non-profit 
organization that assists youth who are homeless, at-risk, and/or victims of sex 
trafficking. Weston was not selected for jury duty. 

Search of the Residence of Dennis Weston 

40. On June 26, 2018 a search warrant was executed at the residence of Dennis 
Weston. Pursuant to the warrant an iPhone was seized from Weston. During the 
search Weston told FBI agents that he was not issued a phone through his 
employer. That same day agents spoke to an employee at the McLaughlin Youth 
Center who knew Weston. The employee informed agents that Weston was issued 
an iPhone by the Department of Juvenile Justice and that it was located in his 
office. Later that day employees of the Alaska Health and Social Services Security 
Office located at the McLaughlin Youth Center took custody of the aforementioned 
iPhone and the hard drive from the desktop computer located in Weston’s office. 
The back of the iPhone was marked with the International Mobile Equipment 
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Identity (IMEI) 359305064431893. The hard drive was manufactured by Seagate 
and identified by the serial number W765SX82. 

Mobile Devices 

41. In my training and experience, I know that individuals who use smart 
phones, tablets, and other portable devices may back those devices up to the cloud 
or to a computer. Back-ups can be useful in the event that a user loses the data 
from their portable device. By maintaining a back-up copy of the data from their 
portable device, a user who has lost the data from his portable device is able to 
restore much of what may have previously been on the system. Back-ups to the 
cloud may occur automatically, or may be initiated by the user. These back-ups 
are maintained on servers operated by the cloud hosting service. For instance, 
Apple users may choose to back up their iOS devices to servers maintained by 
Apple. For back-ups to a computer, this process can be accomplished through 
connection of the portable device to the computer through a USB, Firewire, or 
other similar type of port. Once connected, the digital device may back up 
automatically, or may require the user to initiate the process. Once completed, 
depending upon the settings chosen by the user, a partial or complete copy of the 
data present on the portable device will be saved onto the computer. Whether 
back-up to the cloud or to a computer, stored material will generally remain 
unchanged unless manipulated by the user in some way, or until overwritten 
during a subsequent back-up. 
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42. In my training and experience, I know that if an communicates by text 
message on a smartphone or tablet, and they sync or back up their device to a 
computer, the messages and history may be backed up and stored on the computer 
even if the individual later deletes them from the device. 

SPECIFIC METHODS OF SEARCHING FOR DIGITAL EVIDENCE 

43. I am seeking authority to search for, among other things, items containing 
digital data, more particularly described in Attachment B. Consistent with Rule 
41(e)(2)(B), the warrant I am applying for would permit seizing, imaging, or 
otherwise copying storage media that reasonably appear to contain some or all of 
the evidence described in the warrant, and would authorize a later review of the 
media or information consistent with the warrant. The later review may require 
techniques, including but not limited to computer-assisted scans of the entire 
medium, that might expose many parts of a hard drive to human inspection in order 
to determine whether it is evidence described by the warrant. 

44. The search of a smart phone, computer hard drive, or other computer storage 
medium is a time-consuming manual process often requiring months of work. This 
is so for a number of reasons, including the complexity of computer systems, the 
multiple devices upon which computing can take place, and the tremendous storage 
capacity of modern day computers, and the use of encryption or wiping software. As 
explained above, modern day computers and storage devices are capable of holding 
massive quantities of child pornography, and the volume of evidence seized in these 
cases can be immense. I am aware of cases in which individuals have possessed 
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thousands of images of child pornography on their computer, multiple computers 
and hard drives, or dozens of storage media upon which contraband images were 
found. I know from my training and experience, and from my discussions with 
trained computer forensic examiners, that a review of such quantities of evidence 
can take a significant amount of time. Second, there is a limited pool of personnel 
capable of conducting a forensic examination. Third, in some instances an 
individual may utilize encryption software or other publically-available techniques 
such as wiping software to hide their collections of child pornography. Forensic 
tools are available to circumvent some of these techniques; however, these tools may 
require a significant allocation of resources and a substantial period of time. 

45. Some or all of the following search methods may be used to conduct the 
forensic search in this case. These methods are not listed in any particular order, 
nor are their listings in this affidavit a representation that they will be used in this 
or any other case. Moreover, this list simply provides an example of techniques that 
may be used, and is not intended to bind the forensic examiner to only these 
techniques: 

a. Keyword Searches'. I know that computer forensic utilities 
provide the capability for a user to search for specific key words that 
may exist on a piece of digital media. I intend to use specific 
keywords known to be related to either the subject's illicit internet 
activities or child pornography. As it concerns child pornography, 
examples of such keywords include, but are not limited to "preteen," 
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"hussyfan," and "r@ygold." Those keyword searches will indicate files 
and other areas of the hard drive that need to be further reviewed to 
determine if those areas contain relevant data. A list of keywords 
utilized will be maintained with the records of the forensic 
examination. 

b. Data Carving'. I know that, as previously mentioned, data 
residue may be left in the "free," "unallocated," or "slack" space of a 
computer hard drive, that is, the space not currently used by active 
files. I further know that, as previously mentioned, many operating 
systems utilize temporary storage often referred to as "swap space" 
on the hard drive to store contents from main system memory. Such 
unallocated and swap space may contain the residue of files that can 
be carved out, often in an automated or semi-automated fashion. I 
intend to use forensic tools to carve out files, in particular, image files 
such as JPEG and GIF files. The mere act of carving out such files 
does not expose me to the contents of such recovered files, but makes 
those files available for further relevancy checks, such as keyword 
searches (explained above) and hash value comparisons (explained 
below). 

c. Hash Value Comparisons'. I know that computer forensic 
utilities provide the capability to utilize a function known as a hash 
algorithm. A hash algorithm uses a mathematical formula to analyze 
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the data composing a file, and to generate a unique "fingerprint" for 
that file. The act of hashing a piece of data does not reveal to an 
investigator any information about the contents of that data. 
However, I know that computer forensic applications often contain 
databases of known hash values for files. Some of those files are 
"ignorable," which enables other forensic processes to ignore files 
(such as the Windows operating system) that are not evidentiary in 
nature. Some of the files are "alert" files, such as the Child Victim 
Identification Program (CVIP) hash set that contains hash values for 
a small subset of the identified picture and video files for known 
victims of child pornography. CVIP alert files notify an examiner 
that a file appears to contain known depictions of child pornography. 
I seek permission to utilize automated hash value comparisons to 
both exclude irrelevant files, and to locate known child pornography 
files. Hash value comparisons are useful, but not definitive, as even 
a single-bit change to a file will alter the hash value for the file. The 
forensic review team does not intend to rely solely on hash value 
comparisons, but intends to utilize them in order to assist with 
identifying relevant evidence. The use of this search method is 
intended to narrow the search. A search of known hash values, 
however, will not be used exclusively because I know that when 
previously identified images of child pornography are found on a 
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target's computer, typically there are many more images of child 
pornography with unknown hash values. Using a hash value search 
method exclusively would not uncover these images as well as other 
evidence authorized by this warrant and described in Attachment B. 

d. Opening Container Files, Encrypted Volumes, and Embedded 
Files : I know that relevant data may be compressed, encrypted, or 
otherwise embedded in other files or volumes. It is often not possible 
through any automated process to examine the contents of such 
containers without opening them, just as it is not possible to examine 
the contents of a locked safe without first opening the safe. In the 
event that compressed, encrypted, or otherwise embedded files or 
volumes may exist on the seized items, I intend to use sophisticated 
forensic tools to attempt to open any such container files that may 
reasonably contain evidence of child pornography. 

e. File Header / Extension Checks : I know that individuals 
involved in illegal activities on a computer often change the extension 
of a file (such as .jpg) to some other incompatible extension (such as 
.txt) in order to disguise files from casual observers. The extension of 
a file, however, is not necessarily linked to the "header" of a file, 
which is a unique marking imbedded automatically in many types of 
files. By comparing the extension of a file with the "header 
information" of a file, it is possible to detect attempts to disguise 
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evidence of illegal activities. Such a comparison can be made in an 
automated process by computer forensic tools. I intend to run an 
automated header comparison to detect such efforts, and intend to 
review any such files that reasonably may contain evidence of child 
pornography. 

f. Thumbnail / Image Views : Although hash value comparisons 
can positively identify known child pornography depictions, a 
negative hash value comparison does not exclude an image from 
suspicion. There is no known alternative for visually inspecting each 
image file. I therefore intend to examine at least a thumbnail image 
of each image file on the digital media whether "live," "data carved," 
or identified by header. 

g. Registry / Log File Checks : I know that it is necessary in any 
criminal case to establish not only that a crime has occurred, but also 
to establish what person committed that crime. Operating systems 
and computer programs often maintain various administrative files 
such as logs that contain information about user activities at certain 
times. In the Windows operating system, for example, some of these 
files are collectively referred to as "the registry". Such files contain 
specific information about users, often including e-mail addresses 
used, passwords stored, and programs executed by a particular user. 
These files may also contain evidence regarding storage devices that 


Case 3:18-mj-00382-DMS Document 1-1 Filed 07/19/18 Page 35 of 40 


have been connected to a computer at some time. Multiple backup 
copies of such files may exist on a single computer. I intend to 
examine these files to attempt to establish the identity of any user 
involved in the receipt, possession, distribution, and transportation of 
child pornography, and to establish methods (such as software used) 
and dates of this activity. 

h. Metadata / Alternative Data Streams : I know that many file 
types, operating systems, and file systems have mechanisms for 
storing information that is not immediately visible to the end user 
without some effort. Metadata, for example, is data contained in a 
file that is not usually associated with the content of a file, but is 
often associated with the properties of the application or device that 
created that file. For example, a digital camera photograph often has 
hidden data that contains information identifying the camera that 
manufactured it, and the date the image was taken. Some file 
systems for computers also permit the storage of alternate data 
streams, whereby a file such as a text file may hide an image file that 
would not be immediately visible to an end user without some action 
taken. I know that both metadata and alternative data streams may 
contain information that may be relevant to child pornography 
offenses. Metadata and alternative data streams are often identified 
and processed automatically by computer forensic utilities. I intend 
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to review any such data that is flagged by any process above as being 
relevant to the receipt, possession, distribution, and transportation of 
child pornography. 

46. With rare exception, the above-listed search techniques will not be performed 
on original digital evidence. Instead, I know that the first priority of a digital 
evidence forensic examination is the preservation of all data seized. As such, 
original digital media will be, wherever possible, copied, or "imaged," prior to the 
start of any search for evidence. The copy will be authenticated digitally as 
described in the paragraph below. 

47. I know that a digital forensic image is the best possible copy that can be 
obtained for a piece of digital media. Forensic imaging tools make an exact copy of 
every accessible piece of data on the original digital media. In general, the data 
contained on the original media is run through a hashing algorithm as described 
above, and a hash value for the entire device is generated. Upon completion of the 
imaging process, the same hash algorithm is run on the imaged copy to insure the 
copy is an exact duplicate of the original. 

48. Criminal Procedure Rule 41 specifically states “The officer may retain a copy 
of the electronically stored information that was seized or copied.” Fed. R. Crim. P. 

41 (f)(1)(B). Moreover, upon identification of contraband, the item is subject to 
forfeiture, and the owner has a reduced expectation of privacy in those seized 
devices. Consequently, should a seized device be found during the authorized 
forensic review to contain child pornography, it will be retained by the United 


Case 3:18-mj-00382-DMS Document 1-1 Filed 07/19/18 Page 37 of 40 


States, and may be searched without further authorization of the Court for the 
evidence described in Attachment B. Such a later search may be required for the 
following reasons: 

a. Should the execution of the warrant uncover data that may later 
need to be introduced into evidence during a trial or other 
proceeding, the authenticity and the integrity of the evidence and the 
government's forensic methodology may be contested issues. 
Retaining copies of seized storage media may be required to prove 
these facts. 

b. Returning the original storage medium to its owner will not 
allow for the preservation of that evidence. Even routine use may 
forever change the data it contains, alter system access times, or 
eliminate data stored on it. 

c. Because the investigation is not yet complete, it is not possible 
to predict all possible defendants against whom evidence found on 
the storage medium might be used. That evidence might be used 
against persons who have no possessory interest in the storage 
media, or against persons yet unknown. Those defendants might be 
entitled to a copy of the complete storage media in discovery. 
Retention of a complete image assures that it will be available to all 
parties, including those known now and those later identified. 
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d. The act of destroying or returning storage medium could create 
an opportunity for a defendant to claim, falsely, that the destroyed or 
returned storage medium contained evidence favorable to him. 
Maintaining a copy of the storage medium would permit the 
government, through an additional warrant if necessary, to 
investigate such a claim. 

e. Similarly, should a defendant suggest an explanation for the 
presence of evidence on storage medium or some defense, it may be 
necessary to investigate such an explanation or defense by, among 
other things, re-examining the storage medium with that explanation 
or defense in mind. This may require an additional examination of 
the storage medium for evidence that is described in Attachment B 
but was not properly identified and segregated previously. 

49. In the event that a piece of digital media is found not to be (a) an 
instrumentality of the offense, (b) a fruit of the criminal activity, (c) contraband, or 
(d) evidence of the offenses specified herein, it will be returned as quickly as 
possible. 

CONCLUSION 

50. Based upon the information above, your affiant submits that there is 
probable cause to believe that violations of Title 18, United States Code, Sections 
2422, have been committed, and that the items described in Attachment B contain 
evidence, fruits, and instrumentalities of those violations and that the items 
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described in Attachment B are likely to be found at the premises described in 
Attachment A. 

51. I request that the Court issue a warrant authorizing a search of the 
SUBJECT PREMISES that is described in Attachment A, for the items described 
Attachment B. 


Signature Redacted 


cy 


DARp^ALLISON 




Special Agent 

Federal Bureau of Investigation 


Subscribed and sworn to before me 



this t 5* day of July 2018 



yy ISI BERNARD ZIMMERMAN 

V it n ■■ • AIA-rn ■■ mni- 


U.S. MAGISTRATE JUDGE 
SIGNATURE REDACTED 


/**<>-< — 



District of Alaska 
Anchorage, Alaska 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


IN THE MATTER OF THE SEARCH OF 


Apple iPhone, IMEI 359305064431893 
And Seagate Hard Drive S/N W765SX82, 
both currently located at the McLaughlin 
Youth Center, Anchorage, Alaska 


) Case No. 3:18-mj-00382 


) 

) UNDER SEAL 

) 

) 

) 

) 


ATTACHMENT A 

Property to be searched 

The property to be searched is an Apple iPhone, identified by the 
International Mobile Equipment Identity (IMEI) 359305064431893, and a Seagate 
hard drive identified by the serial number W765SX82. Both items are currently 
located at the McLaughlin Youth Center, 2600 Providence Drive, Anchorage, Alaska 
in the custody of an employee of the Health and Social Services Security Office. 


Attachment A 
Affidavit in Support of Search Warrant 

3:18-mj-00382 
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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF ALASKA 


IN THE MATTER OF THE SEARCH OF ) Case No. 3:18-mj-00382 


) 

Apple iPhone, IMEI 359305064431893 ) UNDER SEAL 

And Seagate Hard Drive S/N W765SX82, ) 
both currently located at the McLaughlin ) 

Youth Center, Anchorage, Alaska ) 

) 


ATTACHMENT B 


Property to be seized 

1. The property to be seized constitute contraband, fruits, 
instrumentalities, and evidence of violations, or attempted violations, of 18 U.S.C. 

§§ 2422(b) attempted coercion and enticement of a minor. 

2. For any computer or storage medium whose seizure is otherwise 
authorized by this warrant, and any computer or storage medium that contains or 
in which is stored records or information that is otherwise called for by this warrant 
(hereinafter “COMPUTER”): 

i. Child pornography and child erotica; 

ii. Visual depictions of minors engaged in sexually explicit conduct; 

iii. Records and information relating to the sexual exploitation of children, 
including correspondence and communications with minors, or with 
parents of guardians, whether fictional or actual; 


Attachment B 
Affidavit in Support of Search Warrant 

3:18-mj-00382 
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IV. 


Records and information showing access to and/or use of mail, 
telephones, email, text messaging, social networking, or other 
communications portals, to communicate about with minors or adults 
about illicit sexual conduct with a minor, child pornography, and child 
exploitation; and 

v. Information, correspondence, records, documents or other materials 
constituting evidence of or pertaining to sexual contact with minors, 
whether made to minors directly to minors, their parents or guardians, 
whether fictional or actual; 

vi. Information, correspondence, records, documents or other materials 
constituting evidence of or pertaining to child pornography, child 
erotica, or visual depictions of minors engaged in sexually explicit 
conduct; or constituting evidence of or pertaining to the production, 
possession, receipt, distribution, accessing, or transmission through 
interstate or foreign commerce of child pornography, child erotica, or 
visual depictions of minors engaged in sexually explicit conduct; or 
constituting evidence of or pertaining to an interest in child 
pornography or sexual activity with children, to include dolls, toys, 
clothing, or other items that have been or appear to have been used to 


Attachment B 
Affidavit in Support of Search Warrant 
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engage in the sexual exploitation of children, or that have been or 
appear to have been used to satisfy a sexual interest in children, 

vii. Records and information relating to the identity or location of the 
persons suspected of violating the statutes described above 

viii. Records and information showing access to and/or use of mail, 
telephones, email, text messaging, social networking, or other 
communications portals, to communicate about with minors or adults 
about illicit sexual conduct with a minor, child pornography, and child 
exploitation; and 

ix. Any and all information associated with the following identifiers: 

i. Email name, 

ii. Other social networking sites or identifiers, and 

iii. any other email, instant messenger, or social media account that 
has communicated about the illicit sexual conduct with a minor, 
or that has sent or received, or attempted to send or receive, or 
communicated about the sending or receiving of, images or 
videos of child pornography 

x. evidence of who used, owned, or controlled the COMPUTER at the 
time the things described in this warrant were created, edited, or 
deleted, such as logs, registry entries, configuration files, saved 

Attachment B 
Affidavit in Support of Search Warrant 
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usernames and passwords, documents, browsing history, user profiles, 
email, email contacts, “chat,” instant messaging logs, photographs, and 
correspondence; 

xi. evidence of software that would allow others to control the 

COMPUTER, such as viruses, Trojan horses, and other forms of 
malicious software, as well as evidence of the presence or absence of 
security software designed to detect malicious software; 

xii. evidence indicating how and when the computer was accessed or used 
to determine the chronological context of computer access, use, and 
events relating to the crime(s) under investigation and to the computer 
user; 

xiii. evidence indicating the computer user’s knowledge and/or intent as it 
relates to the crime(s) under investigation; 

xiv. evidence of the attachment to the COMPUTER of other storage devices 
or similar containers for electronic evidence; 

xv. evidence of programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

xvi. evidence of the times the COMPUTER was used; 

xvii. passwords, encryption keys, and other access devices that may be 
necessary to access the COMPUTER; 
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xviii. documentation and manuals that may be necessary to access the 

COMPUTER or to conduct a forensic examination of the COMPUTER; 

xix. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

xx. records of or information about the COMPUTER’S Internet activity, 
including firewall logs, caches, browser history and cookies, 
“bookmarked” or “favorite” web pages, search terms that the user 
entered into any Internet search engine, and records of user-typed web 
addresses; and 

xxi. contextual information necessary to understand the evidence described 
in this attachment. 

As used above, the terms “records” and “information” includes all forms of 
creation or storage, including any form of computer or electronic storage (such as 
hard disks or other media that can store data); any computer file; any handmade 
form (such as writing); any mechanical form (such as printing or typing); and any 
photographic form (such as microfilm, microfiche, prints, slides, negatives, 
videotapes, motion pictures, or photocopies). 

The term “computer” includes all types of electronic, magnetic, optical, 
electrochemical, or other high speed data processing devices performing logical, 
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arithmetic, or storage functions, including desktop computers, notebook computers, 
mobile phones, tablets, server computers, and network hardware. 

The term “storage medium” includes any physical object upon which 
computer data can be recorded, including external and internal hard drives, flash 
drives, thumb drives, micro SD cards, macro SD cards, DVDs, gaming systems, SIM 
cards, cellular phones capable of storage, floppy disks, compact discs, magnetic 
tapes, memory cards, memory chips, and other magnetic, optical, or solid-state 
media. 

XXXXXXXXXXXXXXXXXXXX NOTHING FOLLOWS XXXXXXXXXXXXXXXXXX 
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